# Multiple Plugins Combined Example
#
# This example demonstrates using multiple plugins together for enhanced security
#
# Prerequisites:
# 1. Generate JWT keys:
#    openssl genrsa -out jwt_private.pem 2048
#    openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 2. Download Cloudflare IPs:
#    curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
#    curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
#
# 3. Add to /etc/hosts:
#    127.0.0.1 website.local api.local admin.local
#
# 4. Start the stack:
#    docker compose -f docker-compose-plugins-combined.yml up -d
#
# 5. Test each service:
#    # Public website (Cloudflare + path blocking)
#    curl http://website.local/
#    curl http://website.local/admin  # Should be blocked (404)
#
#    # Protected API (JWT required)
#    curl http://api.local/  # Should fail - no JWT
#    curl -H "Authorization: Bearer <token>" http://api.local/  # Success
#
#    # Admin panel (IP whitelist only)
#    curl http://admin.local/  # Success from localhost

version: "3"

services:
  haproxy:
    image: byjg/easy-haproxy:4.6.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
      - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
    environment:
      EASYHAPROXY_DISCOVER: docker
      HAPROXY_CUSTOMERRORS: "true"
      HAPROXY_USERNAME: admin
      HAPROXY_PASSWORD: password
      HAPROXY_STATS_PORT: 1936
    ports:
      - "80:80/tcp"
      - "1936:1936/tcp"

  # Public website with Cloudflare + path blocking
  website:
    image: byjg/static-httpserver
    environment:
      TITLE: "Public Website"
    labels:
      easyhaproxy.http.host: website.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # Combine Cloudflare IP restoration + deny pages
      easyhaproxy.http.plugins: cloudflare,deny_pages

      # Block admin paths, config files, etc.
      easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env,/config
      easyhaproxy.http.plugin.deny_pages.status_code: 404

  # Protected API with JWT validation + path blocking
  api:
    image: byjg/static-httpserver
    environment:
      TITLE: "Protected API"
    labels:
      easyhaproxy.http.host: api.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # JWT validation + block internal endpoints
      easyhaproxy.http.plugins: jwt_validator,deny_pages

      # JWT configuration
      easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
      easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
      easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
      easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem

      # Block internal/debug endpoints
      easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
      easyhaproxy.http.plugin.deny_pages.status_code: 403

  # Admin panel with strict IP restrictions
  admin:
    image: byjg/static-httpserver
    environment:
      TITLE: "Admin Panel"
    labels:
      easyhaproxy.http.host: admin.local
      easyhaproxy.http.port: 80
      easyhaproxy.http.localport: 8080

      # IP whitelist only (strictest security)
      easyhaproxy.http.plugins: ip_whitelist

      # Only allow local and private networks
      easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8
      easyhaproxy.http.plugin.ip_whitelist.status_code: 403